adding password to .ssh/config [closed]

Question

I'm using ubuntu 12.04. I'm using ssh for connecting to many servers daily, so I put their parameters in .ssh/config file; like this :

Host server1
User tux
Port 2202
HostName xxx.x.xx.x

I know we should use key-pair ensure security, however sometimes we can't add public key into the remote machine (e.g. a public SSH server which accepting password and execute a specific command, or an user without a home directory).

So, is there a way to put passwords in this file, for each connection? So when the server asks for a password, the terminal puts its pass and send it to the server, so I need not type the password each time.

Answer 1

No, There is no method to specify or provide on the command line the password in a non-interactive manner for ssh authentication using a openssh built-in mechanism. At least not one what I know of. You could hardcode your password into expect script but it is not a good solution either.

You definitely would want to use keypairs for passwordless authentication as Michael stated, in the end private key is pretty much a big password in the file.

Answer 2

To avoid the string of comments: Yes, this is insecure (not even arguably insecure). I would strongly recommend you only do it in a lab situation on an isolated network or a similiar situation that does not involve production servers or potentientially production server without a full reset/format.

I wanted to set this up as I don't think my 2950 switch supports private/public keys and I hope at some point to get that knowledge, but I am not there yet.

Using an alias and sshpass this can be accomplished.

1. Install sshpass
2. Alter your .ssh/config file to include the username as listed in the question
3. Add an alias to your terminal (I used .bashrc and would recommend against gloabl settings)
4. Use alias to log into the target

My example alias is:

alias ssc='sshpass -pcisco ssh'

Where "cisco" is the password. Note there is no space between the -p and the password.

Usage is (referencing the question):

ssc server1

Note: This answers the question in title only for those using search engines. If you are using servers like the question example, private/public key pairs and not this answer should be used

Answer 3

Yes, as mentioned above there's no way to save the password simply. I would recommend using ssh key for authorization.

first, generate your key :

ssh-keygen

Then copy the key around on your servers/desktops :

ssh-copy-id -i .ssh/id_rsa.pub user@ip-address:

That's all. You will never be asked for the password again.

I also recommend removing password authorization in general but that's up to you.

Answer 4

I use this script from ~/.local/bin directory

#!/usr/bin/bash

ORIG_SSH=/usr/bin/ssh
HOST=$1

SSHPASS=$(grep -Pzo "Host $HOST"'\s*\n((?!Host).*\n)*#PS\s(\N+)\n' ~/.ssh/config|tail -n 2|head -n 1 | sed 's/#PS //')
if [ -n $SSHPASS ]; then
    export SSHPASS
    sshpass -e $ORIG_SSH $@
else
    $ORIG_SSH $@
fi

Which allows me to specify passphrase as #PS <password> in .ssh/config file.

But, as everybody says, it's better to use ssh-keys with ssh-agent when it's possible

Answer 5

There's no way to do this with ssh, it's as insecure as it can get.

As Danila mentioned you could use expect scripts but I wouldn't bother.

I wonder what are you trying to achieve? Do you want to hop from one server to another? In this case you want to setup and use ssh-agent on your workstation and enable agent forwarding on the target hosts; this way the credential exchange with be routed to your local agent without having to copy your private key around.

Answer 6

The correct way to handle this situation is to use a session-based ssh-agent. Here is how:

$ eval `ssh-agent`
$ ssh-add /home/user/.ssh/your_key
Enter passphrase for /home/user/.ssh/your_key:

The password will be then kept valid for the remainder of the session. You only need to run the first command once, and can add as many keys as you want after that. When the session is killed, so is the agent so there is no hard-coded storage of a password.

Shocked that after so long this answer wasn't here!

Answer 7

You can do this in safer way by using sshpass

1. Set your password without history

   export PS=your_password ;history -d $(history 1)

2. Set host alias as above in ~/.ssh/config

3. Use ssh pass to use environment variable and login to required machine in single command

sshpass -p $PS ssh host_alias

Your environment is holding your password and it is risky that any scripts executing can leak this password if you don't know what you are running